Privacy Policy

enn by anna.

Last updated: 8 October 2026

At enn by anna., we respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, book an appointment or receive a treatment.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch privacy laws.

1. Who we are

enn by anna. is an independent eye beauty business based in Amsterdam, the Netherlands.

For questions about this Privacy Policy or your personal data, please contact:

Business name: enn by anna.

Email: [Business Email Address]

Business address: [Business Contact Address]

KVK number: [To be added after registration]

2. Personal Information We Collect

Depending on how you interact with us, we may collect:

Your name, email address and telephone number.
Appointment details, booking history and treatment preferences.
Payment and transaction information.
Consultation forms and relevant treatment records.
Information about allergies, sensitivities, eye conditions or other health-related matters that you choose to disclose.
Treatment photographs, where applicable.
Website usage information, including cookies and technical data.

We only collect information that is relevant and necessary for the purposes described in this policy.

3. How We Use Your Information

We may use your personal data to:

Manage appointments, bookings and cancellations.
Provide treatments safely and professionally.
Communicate with you about your appointments.
Maintain consultation and treatment records.
Process payments and issue invoices.
Respond to questions, feedback or complaints.
Comply with applicable legal and tax obligations.
Improve our website and services.
Send marketing communications where you have provided the necessary consent or where otherwise permitted by law.

We do not sell your personal information.

4. Legal Basis for Processing

We process personal data only where we have a valid legal basis under the GDPR.

Depending on the purpose, this may include:

Performance of a contract: To manage your booking and provide the treatment you have requested.
Legal obligation: To comply with applicable accounting, tax and other legal requirements.
Legitimate interests: To respond to enquiries, maintain appropriate business records and protect our business, where these interests are not overridden by your rights.
Consent: Where required, including certain marketing activities, publication of treatment photographs and processing health-related information.

Health-related information is treated as special-category personal data and is processed only where an appropriate legal basis and GDPR Article 9 condition apply.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out lawfully before consent was withdrawn.

5. Health Information & Consultation Records

To provide treatments safely, we may ask you to complete a consultation form containing information about allergies, sensitivities or relevant health conditions.

We use this information to assess treatment suitability, identify potential risks and maintain appropriate treatment records.

Access to this information is restricted to those who need it for these purposes.

Where explicit consent is required for processing health-related information, we will request it separately.

You may decline to provide health information, although we may be unable to perform a treatment safely without certain relevant details.

6. Treatment Photographs

We may take photographs to document treatment results where appropriate.

Photographs will only be published on our website, Instagram or other marketing platforms with your separate, explicit consent.

You are not required to agree to marketing photography in order to receive a treatment.

You may withdraw your consent for future use at any time by contacting us.

If you withdraw consent, we will stop using the photographs for marketing and remove them from platforms under our control where reasonably possible, unless another lawful basis requires retention.

7. Sharing Your Information

We may share personal data with trusted service providers where necessary to operate our business, including:

Salonized: Appointment scheduling and client management, where used.
Wix: Website hosting and related website services.
Payment providers: Processing payments, deposits and refunds.
Email and communication providers: Sending appointment confirmations and responding to enquiries.
Professional advisers or public authorities: Where required by law or reasonably necessary for legal matters.

Service providers may process information on our behalf or act as independent controllers, depending on the service.

We do not share your personal data with third parties for their own marketing purposes without an appropriate legal basis.

8. Data Storage & Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure.

Personal information may be stored in secure booking systems, website services and other business tools.

Access is limited to those who need the information for legitimate business purposes.

Although we take reasonable precautions, no method of electronic storage or transmission can be guaranteed to be completely secure.

9. How Long We Keep Your Information

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law.

Financial and accounting records: Generally retained for 7 years in accordance with Dutch tax record-keeping obligations.
Appointment and treatment records: Retained for [Specify retention period].
Health and consultation information: Retained for [Specify retention period].
Marketing photographs: Retained until consent is withdrawn or the photographs are no longer needed for the stated purpose, subject to applicable legal requirements.
Marketing contact information: Retained until you unsubscribe, withdraw consent or the information is no longer required.

When personal data is no longer needed, we will securely delete or anonymise it where appropriate.

10. Cookies & Website Analytics

Our website is hosted by Wix and may use cookies or similar technologies.

Some cookies are necessary for the website to function properly. Others may be used for analytics, performance or marketing purposes.

Where required by law, we will request your consent before placing non-essential cookies.

You can manage your cookie preferences through our website's cookie settings, where available, or through your browser.

Further information about the cookies used on our website will be provided through our cookie notice or cookie settings.

11. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (EEA).

Where such transfers occur, we will ensure that an appropriate legal transfer mechanism and safeguards are in place, as required by the GDPR.

These may include adequacy decisions or approved Standard Contractual Clauses, where applicable.

12. Your Rights

Under the GDPR, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate information.
Request deletion of your personal data in certain circumstances.
Request restriction of certain processing activities.
Object to processing based on legitimate interests.
Request data portability where applicable.
Withdraw consent at any time where processing is based on consent.

To exercise your rights, please contact us using the details provided in this policy.

We will respond to requests within the time limits required by applicable law, generally within one month.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Website: https://autoriteitpersoonsgegevens.nl

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business practices, services or legal requirements.

The latest version will be available on our website, together with the date of the most recent update.

14. Contact Us

If you have any questions about this Privacy Policy or how your personal data is handled, please contact: